Ech0 EUVD-2026-65444

Exploitation requires an authenticated session with Ech0 administrative privileges (PR:H confirmed by CVSS 4.0 vector). For the primary SVG variant, no non-default configuration is required - image/svg+xml is included in the default AllowedTypes list, making any unpatched default Ech0 deployment before 4.4.3 vulnerable without any configuration change by the operator. For the secondary Content-Type spoofing variant, the attacker need only control the multipart header value in the upload request, which requires no special server configuration. Once a malicious file is uploaded, no authentication is required for victim-side execution - the static file route /api/files/ is served outside authentication middleware, meaning any user (authenticated or anonymous) who accesses the file URL triggers the payload. Exploitation is bounded by the admin credential prerequisite on the upload side and passive user interaction (UI:P) on the victim side; the absence of CSP headers removes a key browser-side limiting factor.

The CVSS 4.0 score of 4.8 accurately reflects the elevated privilege prerequisite (PR:H): exploitation requires a compromised or malicious administrator account, positioning this as an insider threat or post-compromise lateral-impact scenario rather than an opportunistic external attack. The scope change captured in the subsequent-system metrics (SC:L/SI:L) is the most operationally significant risk factor - a single admin upload produces a persistent payload that affects every user who accesses the URL, with no authentication required to trigger execution. EPSS data was not included in the provided intelligence, so probabilistic exploitation likelihood cannot be quantified; no CISA KEV listing and no confirmed public exploit code are present, further supporting a lower urgency posture for most organizations. The absence of CSP headers eliminates a common browser-side defense layer, meaning impact is not mitigated at the client. The conflict between the admin-privilege requirement and the broad downstream user impact means risk assessment must be scoped by trust model: organizations that grant admin access broadly or have shared credentials should treat this with greater urgency than those with tightly controlled admin roles. Overall, this is a real vulnerability with bounded exploitability but meaningful cross-user blast radius once triggered.

An attacker who has obtained administrator credentials - through phishing, credential stuffing, or insider access - logs into Ech0 and uploads a crafted SVG file containing an embedded script element that exfiltrates the document.cookie value to an attacker-controlled endpoint; since image/svg+xml is permitted by default, no Content-Type manipulation is required. The file is stored with its original .svg extension and immediately accessible to all users at /api/files/images/<key>.svg via the unauthenticated static route. The attacker distributes the URL to target users (or embeds it in application content), and any user who navigates to the file has their session cookie silently transmitted to the attacker, enabling full session takeover.